Sebastian Bauersfeld
95478f1af6
Address review comments.
2022-09-16 14:35:30 +07:00
Philip Ginsbach
c2bdb69476
remove upper-case variable name
2022-09-15 16:32:16 +01:00
Chris Smowton
88644b6e76
Add change note
2022-09-15 15:35:52 +01:00
Chris Smowton
5a56bb97fc
deprecated-call query: notice calls to methods of specialised generic classes
2022-09-15 12:49:12 +01:00
Sebastian Bauersfeld
20d78972f5
Address review comments.
2022-09-15 16:44:36 +07:00
Chris Smowton
b926bc9efa
Fix and add test for java/subtle-inherited-call involving inheritence from generic types
2022-09-14 22:17:19 +01:00
Chris Smowton
da04673cb0
Fix query java/internal-representation-exposure regarding generic callees, and add a test
2022-09-14 22:17:19 +01:00
Chris Smowton
c149754c6b
Fix java/iterator-remove-failure to handle calls to specialised generic functions
2022-09-14 22:17:19 +01:00
Chris Smowton
3bdccb38b6
Adapt inner-class-could-be-static query now that specialised methods are callable via an implicit this qualifier.
...
Previously such a call always targeted the unbound method, so we checked for an inherited method that could be a specialisation thereof; now we expect it should be directly inherited.
2022-09-14 22:17:19 +01:00
Anders Schack-Mulligen
d713910714
Merge pull request #10334 from aschackmull/java/uniontypeflow
...
Java: Implement union type flow and replace ad-hoc variable tracking in dispatch
2022-09-14 13:34:28 +02:00
Michael Nebel
c5949fad75
C#/Java: Rename to Typed based summary model generation.
2022-09-14 11:06:23 +02:00
Michael Nebel
2d57b7d56a
Java: Sync files.
2022-09-14 11:06:23 +02:00
Michael Nebel
13a802e260
Java: Sync files and make adjusting changes.
2022-09-14 11:06:23 +02:00
Tony Torralba
ac46a38b9d
Update java/ql/src/Security/CWE/CWE-079/XSS.java
2022-09-13 16:49:20 +02:00
Tony Torralba
2b027709e4
Update XSS qhelp
2022-09-13 16:39:48 +02:00
gx1
1c4488e7c8
Updated vulnerable XSS.java version
2022-09-13 15:58:25 +02:00
Anders Schack-Mulligen
c8b93e0910
Java: Replace uses of deprecated variableTrack.
2022-09-13 13:30:40 +02:00
Sebastian Bauersfeld
f95663cdfb
Java: Added change note.
2022-09-13 11:38:15 +07:00
Edward Minnix III
eadb8a3988
Merge pull request #10106 from egregius313/egregius313/android-backup-allowed
...
Java: Query to detect Android backup allowed
2022-09-12 11:14:03 -04:00
Tony Torralba
dd6257c757
Add security-severity
2022-09-12 11:59:01 +02:00
Edward Minnix III
08a17b355e
allowBackup documentation updates
...
Make error messages and descriptions clearer about application backups not being disabled, rather than focusing on `android:allowBackup` specifically.
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-09 09:30:49 -04:00
Edward Minnix III
83c8e22225
Apply suggestions from documentation review
...
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com >
2022-09-08 15:55:00 -04:00
Tony Torralba
6413de6c20
Add change note
2022-09-08 17:38:26 +02:00
Tony Torralba
fb13e7f307
Docs changes
2022-09-08 17:38:25 +02:00
Tony Torralba
b68e6669b8
Refactor TemplateInjection libraries
2022-09-08 17:38:25 +02:00
github-actions[bot]
a9d80a5a48
Release preparation for version 2.10.5
2022-09-08 11:35:54 +00:00
Ed Minnix
c69a2be976
Moved allowBackup query logic to allowsBackup pred
2022-09-07 12:08:25 -04:00
Edward Minnix III
f6c8144eed
Update java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:36 -04:00
Edward Minnix III
9ddfcf935b
Update java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:16 -04:00
Tony Torralba
cd61bd0606
Move files from experimental
2022-09-07 13:13:40 +02:00
Ed Minnix
dca4cd221a
Documentation cleanup for allowBackup query
2022-09-06 14:35:11 -04:00
Tony Torralba
c0dd9dd5d5
Merge pull request #10249 from atorralba/atorralba/regex-dot-bypass-docs
...
Java: Documentation fixes in the "Permissive dot regex" experimental query
2022-09-06 16:18:35 +02:00
Anders Schack-Mulligen
6ffaa6918a
Apply suggestions from code review
2022-09-06 14:11:48 +02:00
Tony Torralba
b94e0d3e69
Merge pull request #10251 from atorralba/atorralba/implicit-pendingintent-sinks
...
Java: Add new AlarmManager sinks to Use of implicit PendingIntents
2022-09-06 11:31:27 +02:00
Erik Krogh Kristensen
6cee635cb5
Merge pull request #10180 from erik-krogh/fixTags
...
Add missing security tags
2022-09-02 08:04:57 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
Tony Torralba
04c230b128
Docs fixes
2022-09-01 09:57:32 +02:00
Tony Torralba
5d9f366ac5
Add change note
2022-09-01 09:53:46 +02:00
Michael Nebel
1cb6d78d35
Merge pull request #10170 from michaelnebel/java/models-io
...
Java: Update models for commons-io and add negative models.
2022-08-31 11:05:09 +02:00
Tony Torralba
2ec53bf78c
Merge pull request #9873 from luchua-bc/java/permissive-dot-regex
...
Java: CWE-625 Query to detect regex dot bypass
2022-08-31 10:24:18 +02:00
luchua-bc
e2e87980cc
Move pattern check to MatchRegexConfiguration::isSink
2022-08-30 22:48:12 +00:00
Ed Minnix
500a6f3b86
Add check for files which provide the app launcher
...
Adds support for filtering which applications include the
`android.intent.action.MAIN` intent.
2022-08-30 12:54:26 -04:00
Michael Nebel
e020ae77e0
Merge pull request #10158 from michaelnebel/csharp/narrowcollectiontypes
...
C#: Narrow collection like types in model generation.
2022-08-30 14:20:57 +02:00
Tony Torralba
1f83c5833b
Merge pull request #10092 from zbazztian/zbazztian/string.replace-taint
...
Java: Add additional taint steps for java.lang.String methods
2022-08-30 12:24:37 +02:00
Michael Nebel
2b1423dd74
Java: Exclude static initializers from model generation.
2022-08-29 14:29:32 +02:00
Michael Nebel
290c35e7c6
Java: Use negative summary models in unsupported external api telemetry query.
2022-08-29 14:28:55 +02:00
erik-krogh
b1e53280a6
fix that the wrong line got deleted
2022-08-29 13:26:02 +02:00
Erik Krogh Kristensen
bd5fd7d963
fix typo in change-note
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-08-29 13:25:54 +02:00
erik-krogh
f09fc7b0fc
Java: add java change-note
2022-08-29 13:10:21 +02:00
erik-krogh
8b37168223
Java: remove security tag from queries not in the security folder and with missing security-severity tags
2022-08-29 13:08:56 +02:00
